jellyfin/Jellyfin.Server.Implementations/Users/DefaultAuthenticationProvider.cs, branch v10.11.0-rc4Unnamed repository; edit this file 'description' to name the repository.
https://git.b0n.dev/jellyfin/atom?h=v10.11.0-rc42025-03-25T15:45:00ZFixed namespaces2025-03-25T15:45:00ZJPVensongithub@jpb.email2025-03-25T15:45:00Zurn:sha1:42bdb22bfb690a6af37d70f12844881d884927b1Increase password hash iterations2024-08-30T17:29:23ZBond_009bond.009@outlook.com2024-08-30T17:26:48Zurn:sha1:e69e097e19b3b4c32dd0f6ca1ca9a562520449d7
It has been a while since this was last updated: https://github.com/jellyfin/jellyfin/pull/6818
Recommendations have changed since: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
Reduce log spam on failed logins2023-08-21T17:09:32ZBond_009bond.009@outlook.com2023-08-21T17:09:32Zurn:sha1:a963bce9beb16f0d66ec0cef8d92f0d4f6536730
Failed logins already get logged higher up the call chain
Replace == null with is null2022-12-05T14:00:20ZBond_009bond.009@outlook.com2022-12-05T14:00:20Zurn:sha1:c7d50d640e614a3c13699e3041fbfcb258861c5aReplace PBKDF2-SHA1 with PBKDF2-SHA5122021-11-10T21:34:54ZBond_009bond.009@outlook.com2021-11-10T21:34:54Zurn:sha1:5265b3eee794762b4de39a68b5bfbf767faaac36
This also migrates already created passwords on login
Source for the number of iterations:
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
Enable nullable for Jellyfin.Server.Implementations2020-12-12T16:20:48ZPatrick Barronbarronpm@gmail.com2020-12-12T16:20:48Zurn:sha1:d9263dacd5d2e3594e08a5c75bedb31cfc4c5c97More spelling corrections.2020-11-18T13:46:14ZGreenbackjimcartlidge@yahoo.co.uk2020-11-18T13:46:14Zurn:sha1:9a323f6df08927b5db06ba634f430523a236265ffix merge2020-06-23T02:24:59Zcrobiberocody@robibe.ro2020-06-23T02:24:59Zurn:sha1:3169b0af8917ac0bfd189fdb2f261be774b8b869Merge remote-tracking branch 'upstream/master' into easypassword2020-06-23T02:23:06Zcrobiberocody@robibe.ro2020-06-23T02:23:06Zurn:sha1:f4d8e0e20cca81b68919ac8d242fa793612d8c85Merge branch 'master' into check-stored-password-exists2020-06-16T18:30:23Zaledaled@wibblr.com2020-06-16T18:30:00Zurn:sha1:05f736defb9b045ace57262d19ec3691414f8bfc
# Conflicts:
# Jellyfin.Server.Implementations/Users/DefaultAuthenticationProvider.cs